mirror of
https://github.com/moons-14/dotfiles.git
synced 2026-10-07 08:14:08 +09:00
flake: add coding-agent validation workflow
This commit is contained in:
@@ -95,26 +95,33 @@ points cannot express the requirement.
|
||||
|
||||
### 4. Prove the change
|
||||
|
||||
Run the validation matrix in
|
||||
[references/review-checklist.md](references/review-checklist.md). At minimum:
|
||||
Invoke the `validate-nix-change` skill and use the task-owned files as its
|
||||
explicit path set. At minimum:
|
||||
|
||||
1. Format the task-owned files with the repository formatter and run
|
||||
`git diff --check`.
|
||||
2. Inspect the complete task diff for accidental files, duplication, leaked
|
||||
1. Inspect `nix run .#check -- plan --paths <task-path>... --json` and confirm
|
||||
the reported units, host classes, and real hosts are correct.
|
||||
2. Run `nix run .#check -- fast --paths <task-path>...` during the edit loop.
|
||||
3. Inspect the complete task diff for accidental files, duplication, leaked
|
||||
secrets, forced values, direct enable assignments, and unrelated rewrites.
|
||||
3. Run `nix flake check`.
|
||||
4. Run `pre-commit run --all-files`.
|
||||
5. Evaluate every affected real host without switching it. For a
|
||||
cross-platform unit or profile, evaluate both NixOS and nix-darwin even if
|
||||
only one class changed. Build an affected configuration with `--no-link`
|
||||
when the current platform can build it.
|
||||
6. Verify selection as well as syntax: confirm that the expected package,
|
||||
4. Run `nix run .#check -- all --paths <task-path>...` after the structure is
|
||||
complete. This evaluates every flake system and builds affected targets for
|
||||
the current platform without activation.
|
||||
5. Verify selection as well as syntax: confirm that the expected package,
|
||||
program, service, group, cask, or external module appears in the resulting
|
||||
configuration.
|
||||
6. Add a `pkgs.testers.runNixOSTest` check through the `test-nixos-service`
|
||||
skill when service startup or another runtime contract cannot be proved by
|
||||
evaluation and a system build.
|
||||
|
||||
Use `nix run .#check -- full` only for CI, scheduled maintenance, or an explicit
|
||||
repository-wide audit. These commands never activate the live system. Do not
|
||||
run `nh os switch`, `nixos-rebuild switch`, `darwin-rebuild switch`,
|
||||
`home-manager switch`, or an equivalent activation command as validation.
|
||||
|
||||
If a command is unavailable, blocked by the environment, or fails for a
|
||||
pre-existing reason, diagnose it and report the exact gap. Never silently skip
|
||||
a required check or weaken the implementation to make a check pass.
|
||||
pre-existing reason, invoke the `debug-nix-failure` skill, diagnose it, and
|
||||
report the exact gap. Never silently skip a required check or weaken the
|
||||
implementation to make a check pass.
|
||||
|
||||
### 5. Audit before completion
|
||||
|
||||
|
||||
@@ -72,56 +72,47 @@ user-owned mutable state unless the requested policy explicitly owns it.
|
||||
|
||||
## Validation matrix
|
||||
|
||||
Run checks from the repository root and keep the exact results for the handoff.
|
||||
Do not switch or activate a live system merely to validate a change.
|
||||
Use the `validate-nix-change` skill and run checks from the repository root.
|
||||
Keep exact results for the handoff. The validation app never switches or
|
||||
activates a live system.
|
||||
|
||||
### Always
|
||||
|
||||
1. Format task-owned files. If the worktree contains unrelated user changes,
|
||||
pass only task-owned paths to the configured formatter when supported.
|
||||
2. Run `git diff --check`.
|
||||
3. Review `git status --short`, `git diff --stat`, and the complete `git diff`.
|
||||
4. Run `nix flake check`.
|
||||
5. Run `pre-commit run --all-files`.
|
||||
1. Run `nix run .#check -- plan --paths <task-path>... --json` and inspect the
|
||||
affected units and hosts.
|
||||
2. Run `nix run .#check -- fast --paths <task-path>...` during implementation.
|
||||
3. Review `git status --short`, `git diff --stat`, and the complete task diff.
|
||||
4. Run `nix run .#check -- all --paths <task-path>...` before handoff. It runs
|
||||
all-system evaluation and compatible targeted builds without activation.
|
||||
5. Reserve `nix run .#check -- full` for CI, scheduled maintenance, or an
|
||||
explicit repository-wide audit.
|
||||
|
||||
Do not run `nh os switch`, `nixos-rebuild switch`, `darwin-rebuild switch`,
|
||||
`home-manager switch`, or an equivalent activation command.
|
||||
|
||||
### NixOS or Home Manager on NixOS
|
||||
|
||||
- Evaluate each affected host's system toplevel derivation.
|
||||
- Build at least one affected NixOS configuration with `--no-link` when the
|
||||
current system supports it.
|
||||
- Confirm that the validation plan includes each affected real NixOS host.
|
||||
- Build affected NixOS configurations with `--no-link` through the validation
|
||||
app when the current system supports them.
|
||||
- Inspect the resulting option that proves selection: for example
|
||||
`environment.systemPackages`, the user's `home.packages`,
|
||||
`systemd.services`, `users.users.<name>.extraGroups`, or the upstream
|
||||
`programs`/`services` option.
|
||||
|
||||
Typical build shape:
|
||||
|
||||
```sh
|
||||
nix build .#nixosConfigurations.<host>.config.system.build.toplevel --no-link
|
||||
```
|
||||
|
||||
### nix-darwin or Home Manager on Darwin
|
||||
|
||||
- Evaluate every affected Darwin host even when running on Linux.
|
||||
- Confirm that every affected Darwin host is evaluated even when running on
|
||||
Linux.
|
||||
- Inspect `homebrew.casks` or `homebrew.brews` for Homebrew-backed additions.
|
||||
- Evaluate the relevant Home Manager program or package option.
|
||||
- Build a Darwin configuration only on a compatible Darwin builder; otherwise
|
||||
report that build as an explicit runtime-validation gap.
|
||||
|
||||
Typical evaluation shapes:
|
||||
|
||||
```sh
|
||||
nix eval --raw .#darwinConfigurations.<host>.system.drvPath
|
||||
nix eval --json .#darwinConfigurations.<host>.config.homebrew.casks
|
||||
```
|
||||
|
||||
Confirm the exact output attribute against the current flake before using a
|
||||
command; do not paste these shapes blindly.
|
||||
- Build a Darwin configuration only on a compatible Darwin runner or builder;
|
||||
otherwise report the build as an explicit platform gap.
|
||||
|
||||
### Profiles and cross-platform changes
|
||||
|
||||
- Determine transitive selection through `meta.includes`, not only direct
|
||||
mentions.
|
||||
- Confirm transitive selection through `meta.includes`, not only direct
|
||||
mentions. The validation plan computes reverse dependency closure.
|
||||
- Evaluate every real host selecting the changed profile.
|
||||
- Evaluate both host classes for a cross-platform profile, even if only one
|
||||
current fragment changed.
|
||||
@@ -134,6 +125,8 @@ command; do not paste these shapes blindly.
|
||||
### Runtime-dependent behavior
|
||||
|
||||
Evaluation and builds cannot prove GUI appearance, credentials, network access,
|
||||
hardware behavior, or successful daemon interaction. State the precise manual
|
||||
post-activation check needed for those behaviors. Never describe evaluation as
|
||||
hardware behavior, successful daemon interaction, or reboot state. For
|
||||
reusable NixOS behavior, use the `test-nixos-service` skill and add a
|
||||
`pkgs.testers.runNixOSTest` check. State the precise manual post-activation check
|
||||
needed for physical hardware or external systems. Never describe evaluation as
|
||||
a runtime test.
|
||||
|
||||
Reference in New Issue
Block a user